This is the accessible text file for GAO report number GAO-07-1038T
entitled 'Nuclear Security: Actions Taken by NRC to Strengthen Its
Licensing Process for Sealed Radioactive Sources Are Not Effective'
which was released on July 12, 2007.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Testimony:
Before the Permanent Subcommittee on Investigations, Committee on
Homeland Security and Governmental Affairs, U.S. Senate:
United States Government Accountability Office:
GAO:
For Release on Delivery Expected at 9:00 a.m. EDT:
Thursday, July 12, 2007:
Nuclear Security:
Actions Taken by NRC to Strengthen Its Licensing Process for Sealed
Radioactive Sources Are Not Effective:
Statement of Gregory D. Kutz, Managing Director:
Forensic Audits and Special Investigations:
Gene Aloise, Director:
Natural Resources and Environment:
John W. Cooney, Assistant Director:
Forensic Audits and Special Investigations:
GAO-07-1038T:
GAO Highlights:
Highlights of GAO-07-1038T, a testimony before the Permanent
Subcommittee on Investigations, Committee on Homeland Security and
Governmental Affairs, U.S. Senate
Why GAO Did This Study:
The Nuclear Regulatory Commission (NRC) regulates domestic medical,
industrial, and research uses of sealed radioactive sources.
Organizations or individuals attempting to purchase a sealed source
must apply for a license and gain the approval of either NRC or an
“agreement state.” To become an agreement state, a state must
demonstrate to NRC that its regulatory program is compatible with NRC
regulations and is effective in protecting public health and safety.
NRC then transfers portions of its authority to the agreement state.
In 2003, GAO reported that weaknesses in NRC’s licensing program could
allow terrorists to obtain radioactive materials. NRC took some steps
to respond to the GAO report, including issuing guidance to license
examiners. To determine whether NRC actions to address GAO
recommendations were sufficient, the Subcommittee asked GAO to test the
licensing program using covert investigative methods.
What GAO Found:
By using the name of a bogus business that existed only on paper, GAO
investigators were able to obtain a genuine radioactive materials
license from NRC. Aside from traveling to a non-agreement state to pick
up and send mail, GAO investigators did not need to leave their office
in Washington, D.C., to obtain the license from NRC. Further, other
than obtaining radiation safety officer training, investigators
gathered all the information they needed for the license from the NRC
Web site.
Figure: Excerpt from the NRC LIcense Acceptance Letter for Bogus
Business:
[See PDF for Image]
"This refers to your application dated February 2, 2007, for an NRC
license. Enclosed with this letter is the license. Please review the
enclosed carefully and be sure that you understand all conditions."
Source: GAO.
[End of figure]
After obtaining a license from NRC, GAO investigators altered the
license so it appeared that the bogus company could purchase an
unrestricted quantity of radioactive sealed sources rather than the
maximum listed on the approved license. GAO then sought to purchase,
from two U.S. suppliers, machines containing sealed radioactive
material. Letters of intent to purchase, which included the altered NRC
license as an attachment, were accepted by the two suppliers. These
suppliers gave GAO price quotes and commitments to ship the machines
containing radioactive materials. The amount of radioactive material we
could have acquired from these two suppliers was sufficient to reach
the International Atomic Energy Agency’s (IAEA) definition of category
3. According to IAEA, category 3 sources are dangerous if not safely
managed or securely protected. Importantly, with patience and the
proper financial resources, we could have accumulated substantially
more radioactive source material.
GAO also attempted to obtain a license from an agreement state, but
withdrew the application after state license examiners indicated they
would visit the bogus company office before granting the license. An
official with the licensing program told GAO that conducting a site
visit is a standard required procedure before radioactive materials
license applications are approved in that state.
As a result of this investigation, NRC suspended its licensing program
until it could determine what corrective actions were necessary to
resolve the weaknesses GAO identified. On June 12, 2007, NRC issued
supplemental interim guidance with additional screening criteria. These
criteria are intended to help a license examiner determine whether a
site visit or face-to-face meeting with new license applicants is
required.
What GAO Recommends:
GAO recommends that NRC develop improved screening criteria to evaluate
new license applications, conduct periodic reviews of license examiners
to ensure the criteria are properly applied, and explore options to
prevent license counterfeiting
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-1038T].
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Gregory D. Kutz at (202)
512-7455 or kutzg@gao.gov or Gene Aloise at (202) 512-3841 or
aloisee@gao.gov.
[End of section]
Mr. Chairman and Members of the Subcommittee:
Thank you for the opportunity to discuss our covert testing of the
Nuclear Regulatory Commission's (NRC) licensing process for sealed
radioactive sources. Under the Atomic Energy Act of 1954, NRC regulates
domestic medical, industrial, and research uses of sealed radioactive
sources through a combination of regulatory requirements, licensing,
inspection, and enforcement. Organizations or individuals attempting to
purchase a sealed source must apply for a license and gain the approval
of either NRC or an "agreement state." To become an agreement state, a
state must first demonstrate to NRC that its regulatory program is
compatible with NRC regulations and is effective in protecting public
health and safety. Through an agreement between NRC and the state
governor, NRC then transfers portions of its regulatory and licensing
authority to the state. According to NRC, there are approximately
22,000 licenses in the United States--NRC administers about 4,400
licenses, and the rest are administered by regulatory authorities in
the 34 agreement states.
Given that terrorists have expressed an interest in obtaining nuclear
material, the Congress and the American people expect licensing
programs for these materials to be secure. However, in 2003, we
reported that weaknesses in the licensing program could allow
terrorists to obtain radioactive materials. We recommended that NRC
close this vulnerability by modifying its licensing process.[Footnote
1] Among other things, we recommended that "NRC modify its process for
issuing specific licenses to ensure that sealed radioactive sources
cannot be purchased before NRC's verification--through inspection or
other means--that the materials will be used as intended." NRC agreed
with this recommendation and referred the issue to a working group
composed of NRC and state representatives to coordinate NRC's response.
In December 2005, the working group delivered its recommendations to
NRC senior management. In December 2006, NRC issued new guidance to
agreement states and NRC regional offices meant to strengthen the
radioactive materials licensing process.[Footnote 2] Although these are
important steps forward, the Subcommittee remained concerned about
whether, almost 6 years after September 11, 2001, terrorists could
still exploit weaknesses in the government's licensing process and
obtain radioactive material. To determine whether NRC actions to
address our 2003 recommendations were sufficient, the Subcommittee
asked us to use covert investigative methods to test the licensing
program.
To perform this investigation, we incorporated two bogus businesses--
one in a non-agreement state and one in an agreement state. We selected
these two states based on their proximity to the Washington, D.C.,
metro area. Using the names of the bogus businesses, we then prepared
and submitted one application for a byproduct materials license to NRC
and a second application to the department of the environment of the
agreement state. In creating these applications, we only used publicly
available information. Our investigators did not actually purchase
radioactive materials for several reasons--first, the primary intent of
our work was to test the licensing process rather than the purchasing
process; second, we did not think the cost borne by the government
would be necessary to prove the point of our work; and third, we did
not have the proper facilities to safely store the radioactive
materials. In performing research for this work, we reviewed our
previous reports on nuclear security and learned about the licensing
process from NRC's Web site. We altered the license we received from
NRC, which enabled us to obtain agreements to purchase more radioactive
material than the original license permitted. We conducted our
investigative work from October 2006 through June 2007 in accordance
with standards prescribed by the President's Council on Integrity and
Efficiency.
In summary, we found the following:
* The license application we submitted to NRC was approved. We received
a license in the mail from NRC about 4 weeks after submitting the
application. Aside from traveling to a non-agreement state to pick up
and send mail, our investigators did not need to leave their office in
Washington, D.C., to obtain the license from NRC. Further, other than
obtaining radiation safety officer training, investigators gathered all
the information they needed for the license from the NRC Web site.
* After obtaining a license from NRC, we sought to purchase, from two
U.S. suppliers, machines containing sealed radioactive material. Our
letters of intent to purchase, which included an altered version of the
NRC license as an attachment, were accepted by the suppliers. These
suppliers gave us price quotes and commitments to ship the machines
containing radioactive materials. The amount of radioactive material we
could have acquired from these two suppliers was sufficient to reach
the International Atomic Energy Agency's (IAEA) definition of category
3. According to IAEA, category 3 sources are dangerous if not safely
managed or securely protected and "could cause permanent injury to a
person who handled them, or was otherwise in contact with them, for
some hours. It could possibly--although it is unlikely--be fatal to be
close to this amount of unshielded radioactive material for a period of
days to weeks."[Footnote 3] Importantly, with patience and the proper
financial resources, we could have accumulated from other suppliers
substantially more radioactive source material than what the two
suppliers initially agreed to ship to us.
* We withdrew our second application from the agreement state
department of the environment after license examiners indicated they
would visit our company office before granting the license. Since we
did not have a company office or the proper storage equipment, we asked
the state to withdraw our application to obtain a license in this
state. According to an official with the licensing program for this
state, the completion of a site visit is a standard procedure before
the state department of the environment approves a radioactive
materials license application.
Background:
Since the September 11, 2001, terrorist attacks there has been concern
that certain radioactive material could be used in the construction of
a radiological dispersion device (RDD). An RDD disperses radioactive
material over a particular target area, which could be accomplished
using explosives or by other means.[Footnote 4] The major purpose of an
RDD would be to create terror and disruption, not death or destruction.
Depending on the type, form, amount, and concentration of radioactive
material used, direct radiation exposure from an RDD could cause health
effects to individuals in proximity to the material for an extended
time; for those exposed for shorter periods and at lower levels, it
could potentially increase the long-term risks of cancer. In addition,
the evacuation and cleanup of contaminated areas after dispersal could
lead to panic and serious economic costs on the affected population. In
2003, a joint NRC/Department of Energy (DOE) interagency working group
identified several radioactive materials (including Americium-241 and
Cesium-137) as materials at higher risk of being used in an RDD,
describing these as "materials of greatest concern."[Footnote 5]
In its risk-based approach to securing radioactive sources, NRC has
made a commitment to work toward implementing the provisions of IAEA's
Code of Conduct. This document provides a framework that categorizes
the relative risk associated with radioactive sources.[Footnote 6]
While NRC has recently focused on upgrading its capacity to track,
monitor, and secure category 1 and 2 sources, which are considered high
risk, category 3 sources are not a primary focus of NRC regulatory
efforts. Category 3 sources include byproduct material, which is
radioactive material generated by a nuclear reactor, and can be found
in equipment that has medical, academic, and industrial applications.
For example, a standard type of moisture gauge used by many
construction companies contains small amounts of Americium-241 and
Cesium-137. According to NRC, it would take 16 curies of Americium-241
to constitute a high-risk category 2 quantity, and 1.6 curies of
Americium-241 is considered a category 3 quantity.
Results of Investigation:
In October and November 2006, using fictitious names, our investigators
created two bogus companies--one in an agreement state and one in a non-
agreement state. After the bogus businesses were incorporated, our
investigators prepared and submitted applications for a byproduct
materials license to both NRC and the department of the environment for
the selected agreement state. The applications, mailed in February
2007, were identical except for minor differences resulting from
variations in the application forms. Using fictitious identities, one
investigator represented himself as the company president in the
applications, and another investigator represented himself as the
radiation safety officer. The license applications stated that our
company intended to purchase machines with sealed radioactive sources.
According to NRC guidance finalized in November 2006 and sent to
agreement states in December 2006, both NRC and agreement state license
examiners should consider 12 screening criteria to verify that
radioactive materials will be used as intended by a new
applicant.[Footnote 7] For example, one criterion suggests that the
license examiner perform an Internet search using common search engines
to confirm that an applicant company appears to be a legitimate
business that would require a specific license. Another screening
technique calls for the license examiner to contact a state agency to
confirm that the applicant has been registered as a legitimate business
entity in that state. If the examiner believes there is no reason to be
suspicious, he or she is not required to take the steps suggested in
the screening criteria and may indicate "no" or "not applicable" for
each criteria. If the license examiner takes additional steps to
evaluate a criterion, he or she should indicate what publicly available
information was considered. If there is concern for a potential
security risk, the guidance instructs license examiners to note the
basis for that concern.
Application to NRC:
Nine days after mailing their application form to NRC, our
investigators received a call from an NRC license examiner. The NRC
license examiner stated that the application was deficient in some
areas and explained the necessary corrections. For example, the license
examiner asked our investigators to certify that the machines
containing sealed radioactive source material, which are typically used
at construction sites, would be returned to the company office before
being transported to a new construction site. The license examiner
explained that this was a standard security precaution. Even though we
did not have a company office or a construction site, our investigators
nevertheless certified their intent to bring the machines back to their
office before sending them to a new location. They made this
certification via a letter faxed to NRC. Four days after our final
correction to the license application, NRC approved our application and
mailed the license to the bogus business in the non-agreement state. It
took a total of 4 weeks to obtain the license. See figure 1 for the
first page of the transmittal letter we received from NRC with our
license.
Figure 1: Excerpt from NRC License Acceptance Letter for Bogus
Business:
[See PDF for image]
Source: GAO.
[End of figure]
The NRC license is printed on standard 8-1/2 x 11 inch paper and
contains a color NRC seal for a watermark. It does not appear to have
any features that would prevent physical counterfeiting. We therefore
concluded that we could alter the license without raising the suspicion
of a supplier. We altered the license so that it appeared our bogus
company could purchase an unrestricted quantity of sealed source
materials rather than the small amounts of Americium-241 and Cesium-137
listed on the original license. We determined the proper language for
the license by reviewing publicly available information.
Next, we contacted two U.S. suppliers of the machines specified in our
license. We requested price quotes and faxed the altered license to the
suppliers as proof that we were certified to purchase the machines.
Both suppliers offered to sell us the machines and provided us price
quotes. One of these suppliers offered to provide twice as many
machines as we requested and offered a discount for volume purchases.
In a later telephone call to one of the suppliers, a representative of
the supplier told us that his company does not check with NRC to
confirm the terms listed on the licenses that potential customers fax
them. He said that his company checks to see whether a copy of the
front page of the license is faxed with the intent to purchase and
whether the requested order exceeds the maximum allowable quantity a
licensee is allowed to possess at any one time.
Although we had no legitimate use for the machines, our investigators
received, within days of obtaining a license from NRC, price quotes and
terms of payment that would have allowed us to purchase numerous
machines containing sealed radioactive source materials. These
purchases would have substantially exceeded the limit that NRC approved
for our bogus company. If these radioactive materials were unsealed and
aggregated together, the machines would yield an amount of Americium-
241 that exceeds the threshold for category 3 materials.
As discussed previously, according to IAEA, category 3 sources are
dangerous if not safely managed or securely protected and "could cause
permanent injury to a person who handled them, or was otherwise in
contact with them, for some hours. It could possibly--although it is
unlikely--be fatal to be close to this amount of unshielded radioactive
material for a period of days to weeks." Importantly, with patience and
the proper financial resources, we could have accumulated, from other
suppliers, substantially more radioactive source material than what the
two suppliers initially agreed to ship to us--potentially enough to
reach category 2. According to IAEA, category 2 sources, if not safely
managed or securely protected, "could cause permanent injury to a
person for a short time (minutes to hours), and it could possibly be
fatal to be close to this amount of unshielded material for a period of
hours to days."
Application to the Agreement State:
Ten days after mailing their application form to the agreement state's
department of environment, our investigators received a call from a
department license examiner. The license examiner stated that the
application was deficient in some areas and said that she would send us
a letter outlining what additional information the state required
before approving the license. The examiner further stated that before
the license was granted, she would conduct a site visit to inspect the
company office and storage facilities cited in our application. Our
investigators subsequently decided not to pursue the license in this
state and requested that their application be withdrawn. According to
an official in the department of environment for this state, the
license examiner followed the required state procedure in requesting a
site visit. The official told us that as a matter of long-standing
state policy, license examiners in this state conduct site visits and
interview company management (especially radiation safety officers)
before granting new licenses for radioactive materials. This state
policy is more stringent than the guidance NRC provided agreement
states in December 2006. The NRC guidance identified a site visit as
one possible screening criterion to use in evaluating a new license
application, but, as discussed above, a site visit is not required
under the NRC guidance.
Corrective Action Briefing:
On June 1, 2007, we contacted NRC and discussed the results of our
work. An NRC official indicated that NRC would take immediate action to
address the weaknesses we identified. After this meeting, we learned
that NRC suspended its licensing program for specific licenses until it
could determine what corrective actions were necessary to resolve the
weaknesses. NRC also held a teleconference with a majority of the 34
agreement states to discuss our work. On June 12, 2007, NRC issued
supplemental interim guidance with additional screening criteria. These
criteria are intended to help a license examiner determine whether a
site visit or face-to-face meeting with new license applicants is
required. NRC told us that it planned to convene a working group to
develop improved guidance addressing the weaknesses we identified.
Conclusions and Recommendations for Executive Action:
NRC's goal is to provide licenses to only those entities that can
demonstrate that they have legitimate uses for radioactive materials.
However, our work shows that there continues to be weaknesses in the
process NRC uses to approve license applications. In our view, a
routine visit by NRC staff to the site of our bogus business would have
been enough to reveal our lack of facilities and equipment.
Furthermore, if NRC license examiners had conducted even a minimal
amount of screening--such as performing common Web searches or making
telephone calls to local government or business offices--they would
have developed serious doubts about our application. Once we received
our license, the ease with which we were able to alter the license and
obtain price quotes and commitments to ship from suppliers of
radioactive materials is also cause for concern. Accordingly, we are
making the following three recommendations to the Chairman of the NRC:
* First, to avoid inadvertently allowing a malevolent individual or
group to obtain a license for radioactive materials, NRC should develop
improved guidance for examining NRC license applications. In developing
improved screening criteria, NRC should consider whether site visits to
new licensees should be mandatory. These improved screening criteria
will allow NRC to provide reasonable assurance that licenses for
radioactive materials will only be issued to those with legitimate
uses.
* Second, NRC should conduct periodic oversight of license application
examiners so that NRC will be assured that any new guidance is being
appropriately applied.
* Third, NRC should explore options to prevent individuals from
counterfeiting NRC licenses, especially if this allows the purchase of
more radioactive materials than they are approved for under the terms
of the original license.
Mr. Chairman, this concludes our statement. We would be pleased to
answer any questions that you or other Members of the Subcommittee may
have at this time.
Contacts and Acknowledgments:
For further information about this testimony, please contact Gregory D.
Kutz at (202) 512-7455 or kutzg@gao.gov or Gene Aloise at (202) 512-
3841 or aloisee@gao.gov. Contacts points for our Offices of
Congressional Relations and Public Affairs may be found on the last
page of this testimony.
FOOTNOTES
[1] GAO, Nuclear Security: Federal and State Action Needed to Improve
Security of Sealed Radioactive Sources, GAO-03-804 (Washington, D.C.:
Aug. 6, 2003).
[2] The guidance was also sent to officials in New Jersey,
Pennsylvania, and Virginia--states that are not yet agreement states
but have filed statements of intent with NRC to achieve agreement state
status.
[3] International Atomic Energy Agency, Code of Conduct on the Safety
and Security of Radioactive Sources (Vienna, Austria: 2004).
[4] According to NRC, a dirty bomb is one type of RDD that combines a
conventional explosive, such as dynamite, with radioactive material.
The terms dirty bomb and RDD are often used interchangeably in the
media. Most RDDs would not release enough radiation to kill people or
cause severe illness--the conventional explosive itself could be more
harmful to individuals than the radioactive material. However,
depending on the scenario, an RDD explosion could create fear and
panic, contaminate property, and require potentially costly cleanup.
[5] The DOE/NRC Interagency Working Group on Radiological Dispersal
Devices, Radiological Dispersal Devices: An Initial Study to Identify
Radioactive Materials of Greatest Concern and Approaches to Their
Tracking, Tagging, and Disposition (Washington, D.C.: 2003).
[6] NRC has endorsed the IAEA Code of Conduct and is working toward the
implementation of its various provisions. On November 8, 2006, NRC
issued a rule to require licensees to report information on the
manufacture, transfer, receipt, disassembly, and disposal of all
category 1 and 2 sources throughout their entire life cycle in the
National Source Tracking System (NSTS). NRC's latest estimate is that
the NSTS will be operational in May 2008. NRC told us that it has plans
to consider including category 3 sources in the NSTS after the system
becomes operational.
[7] Nuclear Regulatory Commission, Checklist to Ensure that Radioactive
Materials Will Be Used As Intended, NUREG-1556, Vol. 20, C (Washington,
D.C.: Nov. 2006).
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site (www.gao.gov). Each weekday, GAO posts
newly released reports, testimony, and correspondence on its Web site.
To have GAO e-mail you a list of newly posted products every afternoon,
go to www.gao.gov and select "Subscribe to Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office 441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125
Washington, D.C. 20548:
Public Affairs:
Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548: